You're completely right in your thinking that it's largely ridiculous and avoidable. The answer is generally lack of separation of duties and least privilege. T

You're completely right in your thinking that it's largely ridiculous and avoidable. The answer is generally lack of separation of duties and least privilege. That L1 tech in a smaller organization might be a member of the domain admins group. And to avoid UAC prompts, might sign into his computer as domain admin account. If something runs as him, it runs as admin. Large file shares where every user has edit permissions are also extremely prevalent. Every user has the ability to destroy the shared drive. I've seen a lot of small organizations where the owner insisted on being an admin, despite having no technical knowledge. He clicks something wrong and the malware's got carte blanche. Old line of business applications will often require exact versions of Flash/Java/whatever which are riddled with security holes. Outside that, there's the 0 days and exploits. But a lot of what I see are setups that grew from small, insecure setups where it didn't matter to big, insecure setups where it did. Combine that with the ROI on security not being immediately tangible, and it's hard to get approval for projects to fix it. Even if you design the most secure systems, unless you've got a seat at the executive table someone will probably overrule you and make exceptions.